feat: session auth, role middleware, login/setup/logout routes

tests/test_auth.py

@@ -0,0 +1,55 @@
+import pytest
+import bcrypt
+from unittest.mock import AsyncMock, patch
+from fablednetmon.models.users import User, UserRole
+
+
+def make_user(role=UserRole.admin):
+    return User(
+        id="test-id",
+        username="admin",
+        email="admin@example.com",
+        password_hash=bcrypt.hashpw(b"password", bcrypt.gensalt()).decode(),
+        role=role,
+        is_active=True,
+    )
+
+
+@pytest.mark.asyncio
+async def test_login_page_returns_200(client):
+    response = await client.get("/login")
+    assert response.status_code == 200
+
+
+@pytest.mark.asyncio
+async def test_login_redirects_to_setup_when_no_users(client, app):
+    with patch("fablednetmon.auth.routes.get_user_count", new=AsyncMock(return_value=0)):
+        response = await client.get("/login")
+    assert response.status_code == 302
+    assert "/setup" in response.headers["Location"]
+
+
+@pytest.mark.asyncio
+async def test_login_success_redirects_to_dashboard(client, app):
+    user = make_user()
+    with patch("fablednetmon.auth.routes.get_user_count", new=AsyncMock(return_value=1)), \
+         patch("fablednetmon.auth.routes.get_user_by_username", new=AsyncMock(return_value=user)):
+        response = await client.post("/login", form={"username": "admin", "password": "password"})
+    assert response.status_code == 302
+    assert "/" in response.headers["Location"]
+
+
+@pytest.mark.asyncio
+async def test_login_failure_returns_400(client, app):
+    user = make_user()
+    with patch("fablednetmon.auth.routes.get_user_count", new=AsyncMock(return_value=1)), \
+         patch("fablednetmon.auth.routes.get_user_by_username", new=AsyncMock(return_value=user)):
+        response = await client.post("/login", form={"username": "admin", "password": "wrong"})
+    assert response.status_code == 400
+
+
+@pytest.mark.asyncio
+async def test_require_role_redirects_unauthenticated(client):
+    response = await client.get("/")
+    assert response.status_code == 302
+    assert "/login" in response.headers["Location"]